They legitimately wanted more security than that, with two-factor and other similar systems to prevent hostile actors inserting bad data.
- Only allow one entry per GSuite ID in Google Forms
- Enforce yubikey 2FA on GSuite.
- Issue each captain a Pixel 1 with Google MDM for remote wiping and app deployment.
- Turn off all other apps (Docs, Fi, Photos, etc...) in GSuite.